What is the Information and Data Protection Commission?

The Information and Data Protection Commission, usually called the IDPC, is Botswana’s supervisory authority for data protection. It is not a new body created by the Data Protection Act, 2024: section 6 continues the Commission that already existed under the repealed Data Protection Act, 2018, carrying its functions and standing forward under the new Act rather than starting again.

Structure (s.7, s.8, s.10)

The Commission is organised into two divisions under section 7: a Data Protection Division and an Access to Information Division. Section 8 covers the appointment of a Commissioner and one or more Deputy Commissioners, who lead the institution. Under section 10, the Commission has operational independence, meaning it is not meant to take instructions from other parts of government in carrying out its data protection functions.

What it actually does (s.12, s.13)

Section 12 gives the Commission general competence as the supervisory authority for the whole Act. Section 13 sets out its core duties:

• Monitoring and enforcing compliance with the Act.
• Handling and investigating complaints from data subjects.
• Conducting investigations on its own initiative, without waiting for a complaint.
• Keeping records of contraventions it becomes aware of.

Section 13(3) makes one point explicit: lodging a complaint with the Commission is free of charge. See complaints for how that process works in practice.

Investigative and search powers (s.14, s.15)

To do its monitoring and enforcement job, the Commission has real investigative reach. Section 14 lets it order information from controllers and processors, carry out data protection audits, and access personal data, information and premises as part of an investigation.

Section 15 goes further, allowing search, seizure and detention, but only with the written consent of the owner or occupier of the premises, or under a warrant. Obstructing an authorised officer carrying out a search under this section is itself a criminal offence, carrying a fine of up to P500,000 or imprisonment of up to 10 years, or both. See penalties for the full picture on offences and fines.

Corrective and advisory powers (s.16, s.17)

Where the Commission finds a contravention, section 16 gives it a range of corrective powers, short of or alongside a fine: warnings, reprimands, compliance orders, ordering a controller to communicate a breach to affected data subjects, and temporary or permanent bans on processing. Administrative fines sit alongside these powers rather than replacing them, and failing to comply with a section 16 order is itself one of the contraventions that attracts the higher tier of fine under section 83.

Section 17 covers the Commission’s authorisation and advisory role: approving codes of conduct, adopting standard contractual clauses for cross-border transfers, and approving binding corporate rules. These come up throughout international data transfers.

Accountability to Parliament (s.18)

The Commission is not left to report on itself without oversight. Section 18 requires it to produce an annual activity report to the Minister within six months of the end of its financial year, and the Minister must lay that report before the National Assembly within three months of receiving it.

Where things actually stand

The Act gives the IDPC a full set of powers on paper, but powers on paper only matter once an institution is actually staffed and reachable. According to a Botswana Daily News report dated 29 July 2025, the Commission was legally established and operating, but not yet fully up and running: it had no permanent office or public address, was significantly understaffed, with the Commissioner having engaged only three contract officers pending approval of further posts, and it had no dedicated public website.

That matters for anyone trying to reach the Commission directly right now, whether to file a complaint, ask a compliance question, or check for guidance. There is no official web address to point to here, and any site claiming to be the Commission’s official portal should be treated with caution until the Commission itself confirms one. Watch the Government Gazette, or this guide, for an update once the Commission secures premises and publishes its own contact details.